A.5.22 Audit Checklist

When to use this

Use this during internal audits to verify that supplier services and security practices are monitored, reviewed, evaluated, and changed through a controlled process.

Checklist

• Supplier monitoring procedure exists.
• Supplier owners are assigned.
• Review frequency is defined based on supplier risk.
• Supplier service reports are received.
• Supplier security reports are reviewed.
• Review results and actions are recorded.
• Supplier nonconformities are escalated and tracked.
• Supplier incidents trigger internal review where relevant.
• Supplier changes are assessed before approval where possible.
• Material changes trigger risk reassessment.
• Contract changes involve relevant stakeholders.
• Supplier audit rights are used where risk justifies them.
• Supplier audit findings are communicated, tracked, and resolved.

Related notes

• A.5.22 Monitoring, Review and Change Management of Supplier Services
• A.5.22 Audit Evidence Pack
• Supplier Service Review and Change Log
• Corrective Action Tracker